e41369fdc485ab723262281494bb5f89dcb027633052dd73828fd5d6c3dcb0fb

Analysis

user interaction
yes
max time kernel
689s
max time network
683s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tomato-UI - Copy/Bin/TomatoModule.dll
Size 13.2MB
Sample260503-trbdfsds7x
SHA256 e41369fdc485ab723262281494bb5f89dcb027633052dd73828fd5d6c3dcb0fb
MD5 a399f063ba7f356fafbc5644ee604e35
SHA1 76caa4b3c804a59fd7f731eab0be04e1f988b3b8
SHA512 0e3e5d9f80e5842ff53d8c3729970918f577f7b1aa0d5a4bf1ef2900152889cb9d9e462eaf887850c5d559c59c5a42b83e071985b0c49c35ab23b6d927c1781c
SSDEEP 393216:Sg+RCqB1qq62k2/mc7dLzgOiSQALizl6jw:Sg+Rdvqqqi5HgCvusw
TLSH
T150D623EA84D921F4EDE34B80338A57CE71D1715D4A6E6C2D36CB1C81AB32D9B4649E33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4424	powershell.exe
1304	powershell.exe
5612	powershell.exe
3552	powershell.exe
6008	powershell.exe
6092	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	camo.githubusercontent.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\tem781F.tmp	Clipup.exe

Launches sc.exe 37 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3812	sc.exe
5364	sc.exe
5520	sc.exe
5824	sc.exe
5528	sc.exe
6100	sc.exe
4848	sc.exe
5756	sc.exe
5636	sc.exe
5800	sc.exe
5672	sc.exe
5784	sc.exe
4344	sc.exe
5956	sc.exe
6116	sc.exe
5548	sc.exe
5712	sc.exe
5936	sc.exe
5648	sc.exe
5784	sc.exe
5496	sc.exe
5544	sc.exe
5588	sc.exe
5576	sc.exe
5228	sc.exe
5500	sc.exe
2472	sc.exe
5940	sc.exe
5180	sc.exe
5536	sc.exe
5552	sc.exe
5616	sc.exe
5768	sc.exe
4724	sc.exe
5652	sc.exe
5704	sc.exe
5740	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4344	PING.EXE
4180	cmd.exe
1304	PING.EXE
5388	cmd.exe
5400	PING.EXE
3728	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4932	chrome.exe
3444	chrome.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	clipup.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5208	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222986830443669"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Modifies registry key 1 TTPs 53 IoCs

Modify Registry

T1112

pid	Process
1044	reg.exe
5452	reg.exe
5476	reg.exe
3296	reg.exe
1836	reg.exe
5708	reg.exe
920	reg.exe
1288	reg.exe
5204	reg.exe
5456	reg.exe
3980	reg.exe
5676	reg.exe
5736	reg.exe
5768	reg.exe
5832	reg.exe
5880	reg.exe
6084	reg.exe
6132	reg.exe
1900	reg.exe
5848	reg.exe
5864	reg.exe
5132	reg.exe
1836	reg.exe
5192	reg.exe
5232	reg.exe
5492	reg.exe
5692	reg.exe
5816	reg.exe
6020	reg.exe
132	reg.exe
5124	reg.exe
5352	reg.exe
5384	reg.exe
6052	reg.exe
2864	reg.exe
5908	reg.exe
5924	reg.exe
5988	reg.exe
6036	reg.exe
5248	reg.exe
5752	reg.exe
6068	reg.exe
1820	reg.exe
3372	reg.exe
5664	reg.exe
5892	reg.exe
5972	reg.exe
2184	reg.exe
2472	reg.exe
5404	reg.exe
5392	reg.exe
5720	reg.exe
6004	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Microsoft-Activation-Scripts.zip:Zone.Identifier	chrome.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5400	PING.EXE
4344	PING.EXE
1304	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
620	rundll32.exe
620	rundll32.exe
3184	chrome.exe
3184	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
4696	powershell.exe
4696	powershell.exe
4696	powershell.exe
3852	powershell.exe
3852	powershell.exe
3852	powershell.exe
964	powershell.exe
964	powershell.exe
964	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
2924	powershell.exe
2924	powershell.exe
2924	powershell.exe
3552	powershell.exe
3552	powershell.exe
3552	powershell.exe
6056	powershell.exe
6056	powershell.exe
6056	powershell.exe
5144	powershell.exe
5144	powershell.exe
5144	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
5456	powershell.exe
5456	powershell.exe
5456	powershell.exe
5640	powershell.exe
5640	powershell.exe
5640	powershell.exe
6028	powershell.exe
6028	powershell.exe
6028	powershell.exe
3552	powershell.exe
3552	powershell.exe
3552	powershell.exe
5764	powershell.exe
5764	powershell.exe
5764	powershell.exe
5884	powershell.exe
5884	powershell.exe
5884	powershell.exe
6008	powershell.exe
6008	powershell.exe
6008	powershell.exe
964	chrome.exe
964	chrome.exe
5612	powershell.exe
5612	powershell.exe
5612	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	3184	chrome.exe
Token: SeCreatePagefilePrivilege	3184	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe
Token: SeShutdownPrivilege	5036	chrome.exe
Token: SeCreatePagefilePrivilege	5036	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe
5036	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe
3184	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5548	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4136	3184	chrome.exe	84
PID 3184 wrote to memory of 4932	3184	chrome.exe	85
PID 3184 wrote to memory of 556	3184	chrome.exe	86
PID 3184 wrote to memory of 556	3184	chrome.exe	86
PID 3184 wrote to memory of 4884	3184	chrome.exe	88
PID 3184 wrote to memory of 4884	3184	chrome.exe	88
PID 3184 wrote to memory of 1828	3184	chrome.exe	89
PID 3184 wrote to memory of 1828	3184	chrome.exe	89
PID 3184 wrote to memory of 732	3184	chrome.exe	90
PID 3184 wrote to memory of 732	3184	chrome.exe	90
PID 3184 wrote to memory of 4916	3184	chrome.exe	91
PID 3184 wrote to memory of 4916	3184	chrome.exe	91
PID 3184 wrote to memory of 3560	3184	chrome.exe	93
PID 3184 wrote to memory of 3560	3184	chrome.exe	93
PID 3184 wrote to memory of 2680	3184	chrome.exe	94
PID 5036 wrote to memory of 4056	5036	chrome.exe	97
PID 5036 wrote to memory of 2540	5036	chrome.exe	98
PID 5036 wrote to memory of 2540	5036	chrome.exe	98
PID 5036 wrote to memory of 3444	5036	chrome.exe	99
PID 5036 wrote to memory of 4144	5036	chrome.exe	100
PID 5036 wrote to memory of 4144	5036	chrome.exe	100
PID 5036 wrote to memory of 220	5036	chrome.exe	102
PID 5036 wrote to memory of 936	5036	chrome.exe	103
PID 5036 wrote to memory of 220	5036	chrome.exe	102
PID 5036 wrote to memory of 936	5036	chrome.exe	103
PID 5036 wrote to memory of 4264	5036	chrome.exe	104
PID 5036 wrote to memory of 4264	5036	chrome.exe	104
PID 5036 wrote to memory of 1068	5036	chrome.exe	105
PID 5036 wrote to memory of 2024	5036	chrome.exe	106
PID 5036 wrote to memory of 2024	5036	chrome.exe	106
PID 5036 wrote to memory of 1236	5036	chrome.exe	107
PID 5036 wrote to memory of 1236	5036	chrome.exe	107
PID 5036 wrote to memory of 4480	5036	chrome.exe	108
PID 5036 wrote to memory of 400	5036	chrome.exe	109
PID 5036 wrote to memory of 2952	5036	chrome.exe	110
PID 5036 wrote to memory of 792	5036	chrome.exe	112
PID 5036 wrote to memory of 792	5036	chrome.exe	112
PID 5036 wrote to memory of 3552	5036	chrome.exe	113
PID 5036 wrote to memory of 3552	5036	chrome.exe	113
PID 5036 wrote to memory of 2404	5036	chrome.exe	114
PID 5036 wrote to memory of 2404	5036	chrome.exe	114
PID 5036 wrote to memory of 3924	5036	chrome.exe	115
PID 2164 wrote to memory of 4724	2164	cmd.exe	120
PID 2164 wrote to memory of 3984	2164	cmd.exe	121
PID 2164 wrote to memory of 4344	2164	cmd.exe	122
PID 2164 wrote to memory of 4884	2164	cmd.exe	123
PID 2164 wrote to memory of 1576	2164	cmd.exe	124
PID 2164 wrote to memory of 3880	2164	cmd.exe	125
PID 2164 wrote to memory of 132	2164	cmd.exe	126
PID 2164 wrote to memory of 3168	2164	cmd.exe	127
PID 2164 wrote to memory of 4596	2164	cmd.exe	128
PID 4596 wrote to memory of 4936	4596	cmd.exe	129
PID 4596 wrote to memory of 964	4596	cmd.exe	130
PID 2164 wrote to memory of 4360	2164	cmd.exe	131
PID 2164 wrote to memory of 1176	2164	cmd.exe	132
PID 2164 wrote to memory of 2588	2164	cmd.exe	133
PID 2164 wrote to memory of 3984	2164	cmd.exe	134
PID 3984 wrote to memory of 4344	3984	cmd.exe	135
PID 2164 wrote to memory of 3904	2164	cmd.exe	136
PID 3904 wrote to memory of 4360	3904	cmd.exe	137
PID 2164 wrote to memory of 3296	2164	cmd.exe	138
PID 2164 wrote to memory of 2588	2164	cmd.exe	139
PID 2164 wrote to memory of 1836	2164	cmd.exe	152
PID 2164 wrote to memory of 5048	2164	cmd.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Tomato-UI - Copy\Bin\TomatoModule.dll",#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0x78,0x108,0x7fff7160c728,0x7fff7160c734,0x7fff7160c740
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,14918585863001664445,7025363288543756767,524288 --field-trial-handle=2028,i,6029857135182922170,17777802510508936216,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1576,i,7460124731814281349,17114034508626651767,262144 --field-trial-handle=2028,i,6029857135182922170,17777802510508936216,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,10103943254732328230,2621341689582125018,524288 --field-trial-handle=2028,i,6029857135182922170,17777802510508936216,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,12199493757923023141,8207908111589424586,2097152 --field-trial-handle=2028,i,6029857135182922170,17777802510508936216,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,2192230552747671059,9842982992748409083,2097152 --field-trial-handle=2028,i,6029857135182922170,17777802510508936216,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4220,i,15903436557131058058,8137471297123441812,2097152 --field-trial-handle=2028,i,6029857135182922170,17777802510508936216,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4232 /prefetch:9
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,12631187995808205184,11503957866000066390,2097152 --field-trial-handle=2028,i,6029857135182922170,17777802510508936216,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4504,i,8102199697732586075,3270589665051630196,524288 --field-trial-handle=2028,i,6029857135182922170,17777802510508936216,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:2680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7160c728,0x7fff7160c734,0x7fff7160c740
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1576,i,6310564882138281321,3082880889382762338,262144 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,15070316370047766816,16258149505821390420,524288 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,4787817178448393576,16574475044956367811,524288 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,2431335901361967291,4952662653584695939,2097152 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,4861751025688136075,8153320917689703412,2097152 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,16026039519707143344,16213395397668539951,2097152 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,14676174378931922834,9315050601599255745,524288 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5508,i,7376180542116646569,2416278431814492771,2097152 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3560,i,13285007526566429707,9976778963960026190,2097152 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,14146133056271444268,5271865932345209797,524288 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=4352 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,304722861496962434,4413176362157314059,524288 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3448,i,13288587499367405684,5720014185288469607,524288 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=3428 /prefetch:14
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=1212,i,15666765539004957864,8147617289330965963,2097152 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5692,i,3922953239471827765,3703766127123813448,2097152 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5892,i,13047169278250013820,3961420249663530384,2097152 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,18167565504639560713,458281198542427862,524288 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3408,i,5053452068456867201,8506779052403150160,262144 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=3440 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3620,i,11415596263530491661,1953627948311764218,524288 --field-trial-handle=1876,i,12436125855654483030,8010401237865515434,262144 --variations-seed-version=20260503-030041.542000-production --mojo-platform-channel-handle=3408 /prefetch:14
  2⤵
  PID:2144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:4724
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:3984
- C:\Windows\System32\findstr.exe
  findstr /v "$" "MAS_AIO.cmd"
  2⤵
  PID:4344
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  PID:4884
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:1576
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:3880
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:132
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:3168
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4936
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:964
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd" "
  2⤵
  PID:4360
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:1176
- C:\Windows\System32\fltMC.exe
  fltmc
  2⤵
  PID:2588
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4344
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c mode con
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\System32\mode.com
    mode con
    3⤵
    PID:4360
- C:\Windows\System32\reg.exe
  reg query HKCU\Console /v QuickEdit
  2⤵
  - Modifies registry key
  PID:3296
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2588
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:1836
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd" -qedit"
  2⤵
  PID:5048
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:4344
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:1176
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "MAS_AIO.cmd"
    3⤵
    PID:4180
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:4696
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:3872
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    PID:3552
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:5044
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:1836
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:8
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:4848
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    PID:4320
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:1460
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:3812
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd" "
    3⤵
    PID:1900
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:964
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:3732
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    PID:2620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4696
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    PID:1460
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:1612
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3728
  - - C:\Windows\System32\PING.EXE
      ping -n 1 activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4344
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck311.activated.win
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4180
  - - C:\Windows\System32\PING.EXE
      ping -n 1 updatecheck311.activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1304
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:8
- - C:\Windows\System32\find.exe
    find /i "/S"
    3⤵
    PID:3296
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:132
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:1132
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    PID:4660
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:3372
- - C:\Windows\System32\mode.com
    mode 76, 34
    3⤵
    PID:3852
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:3980
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:2144
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:1900
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:2980
- - C:\Windows\System32\choice.exe
    choice /C:12345678EH0 /N
    3⤵
    PID:3248
- - C:\Windows\System32\mode.com
    mode 110, 34
    3⤵
    PID:4272
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
    3⤵
    PID:3296
- - C:\Windows\System32\find.exe
    find /i "AutoPico"
    3⤵
    PID:3792
- - C:\Windows\System32\find.exe
    find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:1132
- - C:\Windows\System32\find.exe
    find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:1820
- - C:\Windows\System32\find.exe
    find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:3876
- - C:\Windows\System32\find.exe
    find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:3924
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:2472
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
    3⤵
    PID:2144
- - C:\Windows\System32\findstr.exe
    findstr "577 225"
    3⤵
    PID:4576
- - C:\Windows\System32\cmd.exe
    cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
    3⤵
    PID:1900
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      PID:3872
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:1288
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"
    3⤵
    PID:4344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3852
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
    3⤵
    PID:3168
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
      4⤵
      PID:1304
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
    3⤵
    PID:3416
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
      4⤵
      PID:2332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:964
- - C:\Windows\System32\find.exe
    find /i "Subscription_is_activated"
    3⤵
    PID:3812
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
    3⤵
    PID:2980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4424
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "
    3⤵
    PID:8
- - C:\Windows\System32\find.exe
    find /i "Windows"
    3⤵
    PID:4272
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:3812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3552
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
    3⤵
    PID:5200
- - C:\Windows\System32\findstr.exe
    findstr /i "Windows"
    3⤵
    PID:5208
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
    3⤵
    PID:5348
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      PID:5360
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    PID:5376
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5388
  - - C:\Windows\System32\PING.EXE
      ping -n 1 l.root-servers.net
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5400
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
    3⤵
    PID:5432
- - C:\Windows\System32\find.exe
    find /i "AutoPico"
    3⤵
    PID:5440
- - C:\Windows\System32\find.exe
    find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5464
- - C:\Windows\System32\find.exe
    find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5480
- - C:\Windows\System32\find.exe
    find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5496
- - C:\Windows\System32\find.exe
    find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5512
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:5528
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
    3⤵
    PID:5544
- - C:\Windows\System32\findstr.exe
    findstr "577 225"
    3⤵
    PID:5552
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:5576
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
    3⤵
    PID:5588
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
    3⤵
    PID:5604
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
      4⤵
      PID:5620
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:5636
- - C:\Windows\System32\sc.exe
    sc query ClipSVC
    3⤵
    - Launches sc.exe
    PID:5648
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService
    3⤵
    - Modifies registry key
    PID:5664
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description
    3⤵
    - Modifies registry key
    PID:5676
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName
    3⤵
    - Modifies registry key
    PID:5692
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl
    3⤵
    - Modifies registry key
    PID:5708
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath
    3⤵
    - Modifies registry key
    PID:5720
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName
    3⤵
    - Modifies registry key
    PID:5736
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start
    3⤵
    - Modifies registry key
    PID:5752
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type
    3⤵
    - Modifies registry key
    PID:5768
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:5784
- - C:\Windows\System32\sc.exe
    sc query wlidsvc
    3⤵
    - Launches sc.exe
    PID:5800
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService
    3⤵
    - Modifies registry key
    PID:5816
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description
    3⤵
    - Modifies registry key
    PID:5832
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName
    3⤵
    - Modifies registry key
    PID:5848
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl
    3⤵
    - Modifies registry key
    PID:5864
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath
    3⤵
    - Modifies registry key
    PID:5880
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName
    3⤵
    - Modifies registry key
    PID:5892
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start
    3⤵
    - Modifies registry key
    PID:5908
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type
    3⤵
    - Modifies registry key
    PID:5924
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:5940
- - C:\Windows\System32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:5956
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
    3⤵
    - Modifies registry key
    PID:5972
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
    3⤵
    - Modifies registry key
    PID:5988
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
    3⤵
    - Modifies registry key
    PID:6004
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
    3⤵
    - Modifies registry key
    PID:6020
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
    3⤵
    - Modifies registry key
    PID:6036
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
    3⤵
    - Modifies registry key
    PID:6052
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
    3⤵
    - Modifies registry key
    PID:6068
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
    3⤵
    - Modifies registry key
    PID:6084
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:6100
- - C:\Windows\System32\sc.exe
    sc query KeyIso
    3⤵
    - Launches sc.exe
    PID:6116
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService
    3⤵
    - Modifies registry key
    PID:6132
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description
    3⤵
    - Modifies registry key
    PID:132
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName
    3⤵
    - Modifies registry key
    PID:5124
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl
    3⤵
    - Modifies registry key
    PID:1820
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath
    3⤵
    - Modifies registry key
    PID:1044
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName
    3⤵
    - Modifies registry key
    PID:5132
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start
    3⤵
    - Modifies registry key
    PID:3372
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type
    3⤵
    - Modifies registry key
    PID:920
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:5180
- - C:\Windows\System32\sc.exe
    sc query LicenseManager
    3⤵
    - Launches sc.exe
    PID:4848
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService
    3⤵
    - Modifies registry key
    PID:2184
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description
    3⤵
    - Modifies registry key
    PID:1288
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName
    3⤵
    - Modifies registry key
    PID:2472
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl
    3⤵
    - Modifies registry key
    PID:1836
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath
    3⤵
    - Modifies registry key
    PID:5192
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName
    3⤵
    - Modifies registry key
    PID:5248
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start
    3⤵
    - Modifies registry key
    PID:5232
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type
    3⤵
    - Modifies registry key
    PID:5204
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:5228
- - C:\Windows\System32\sc.exe
    sc query Winmgmt
    3⤵
    - Launches sc.exe
    PID:5364
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
    3⤵
    - Modifies registry key
    PID:5352
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
    3⤵
    - Modifies registry key
    PID:5384
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
    3⤵
    - Modifies registry key
    PID:5404
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
    3⤵
    - Modifies registry key
    PID:5392
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
    3⤵
    - Modifies registry key
    PID:5452
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
    3⤵
    - Modifies registry key
    PID:5456
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
    3⤵
    - Modifies registry key
    PID:5476
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
    3⤵
    - Modifies registry key
    PID:5492
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:5500
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:5496
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:5520
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:5536
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:5548
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:5544
- - C:\Windows\System32\sc.exe
    sc query ClipSVC
    3⤵
    - Launches sc.exe
    PID:5552
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:5580
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:5588
- - C:\Windows\System32\sc.exe
    sc query wlidsvc
    3⤵
    - Launches sc.exe
    PID:5616
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:5620
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:5652
- - C:\Windows\System32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:5672
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:5680
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:5704
- - C:\Windows\System32\sc.exe
    sc query KeyIso
    3⤵
    - Launches sc.exe
    PID:5712
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:5708
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:5740
- - C:\Windows\System32\sc.exe
    sc query LicenseManager
    3⤵
    - Launches sc.exe
    PID:5756
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:5760
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:5768
- - C:\Windows\System32\sc.exe
    sc query Winmgmt
    3⤵
    - Launches sc.exe
    PID:5784
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:5804
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:5824
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    PID:5840
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:5852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService get Version
    3⤵
    PID:5900
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    PID:5948
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "0" "
    3⤵
    PID:5976
- - C:\Windows\System32\findstr.exe
    findstr /i "0x800410 0x800440 0x80131501"
    3⤵
    PID:5980
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
    3⤵
    PID:6016
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
    3⤵
    PID:6024
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
      4⤵
      PID:6020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1304
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
    3⤵
    PID:5396
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"
    3⤵
    PID:5432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5456
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul
    3⤵
    PID:5624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5640
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
    3⤵
    PID:5748
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
    3⤵
    PID:5772
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul
    3⤵
    PID:5780
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE
      4⤵
      PID:5788
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
    3⤵
    PID:5836
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul
    3⤵
    PID:5888
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE
      4⤵
      PID:5832
- - C:\Windows\System32\sc.exe
    sc query wlms
    3⤵
    - Launches sc.exe
    PID:5936
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"
    3⤵
    PID:5908
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"
    3⤵
    PID:5956
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"
    3⤵
    PID:6000
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"
    3⤵
    PID:5976
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
    3⤵
    PID:6012
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
      4⤵
      PID:6040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6028
- - C:\Windows\System32\findstr.exe
    findstr /i "KMS_"
    3⤵
    PID:6032
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul
    3⤵
    PID:5128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3552
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "
    3⤵
    PID:5204
- - C:\Windows\System32\find.exe
    find /i "Ready"
    3⤵
    PID:5208
- - C:\Windows\System32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f
    3⤵
    PID:5384
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"
    3⤵
    PID:5404
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "
    3⤵
    PID:5192
- - C:\Windows\System32\findstr.exe
    findstr /i "Removed Not Found"
    3⤵
    PID:5252
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
    3⤵
    PID:5224
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
      4⤵
      PID:5356
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 92fb8726-92a8-4ffc-94ce-f82e07444653 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285 " "
    3⤵
    PID:5452
- - C:\Windows\System32\find.exe
    find /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"
    3⤵
    PID:5444
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"
    3⤵
    PID:5512
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    PID:5576
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
    3⤵
    PID:5468
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul
    3⤵
    PID:440
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Control Panel\International\Geo" /v Name
      4⤵
      PID:5648
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul
    3⤵
    PID:5700
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Control Panel\International\Geo" /v Nation
      4⤵
      PID:5732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Users\Admin\Downloads\Microsoft-Activation-Scripts\MAS\All-In-One-Version-KL\MAS_AIO.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6008
- - C:\Windows\System32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:5208
- - C:\Windows\System32\ClipUp.exe
    clipup -v -o
    3⤵
    PID:2588
  - - C:\Windows\System32\clipup.exe
      clipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\tem7F63.tmp
      4⤵
      Checks SCSI registry key(s)
      PID:5564
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
    3⤵
    PID:5464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5612
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "
    3⤵
    PID:5856
- - C:\Windows\System32\find.exe
    find /i "Windows"
    3⤵
    PID:5800
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
    3⤵
    PID:5756
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    PID:5868
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
    3⤵
    PID:5972
- - C:\Windows\System32\findstr.exe
    findstr /i "Windows"
    3⤵
    PID:5988
- - C:\Windows\System32\reg.exe
    reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f
    3⤵
    PID:5456
- - C:\Windows\System32\reg.exe
    reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f
    3⤵
    PID:6108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"
    3⤵
    PID:3852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6092
- - C:\Windows\System32\choice.exe
    choice /C:10 /N
    3⤵
    PID:5376
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2864

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5548

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -o
1⤵
PID:5228
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\SystemTemp\tem781F.tmp
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GenuineTicket.xml

Path C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\GenuineTicket.xml
Size 1KB
SHA256 1d19fed36f7d678ae2b2254a5eef240e6b6b9630e5696d0f9efb8b744c60e411
MD5 67a8abe602fd21c5683962fa75f8c9fd
SHA1 e296942da1d2b56452e05ae7f753cd176d488ea8
SHA512 70b0b27a2b89f5f771467ac24e92b6cc927f3fdc10d8cb381528b2e08f2a5a3e8c25183f20233b44b71b54ce910349c279013c6a404a1a95b3cc6b8922ab9fc6
TLSH
T1351123B0D2215C40236D27B0C7747EF77B18704BC2B38856FB41965431EB29327521A2
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d4b20187d1a27791dd95f08abe7840e0cdd1ce61f275bd653b136d14b779d85d
MD5 a9c52baf89a3b7bd355ceacb31f4c1fa
SHA1 772d3bd6852fdecd31426b10b2a48b0bb4513a74
SHA512 4b5eb51f8e5d34c50df3f8fbaaf6247de584377339da9ed1a759628bc0c6a5ffa3098bfa7fbf0ca780c77f39d44b791375aefc45ca92b2ec120b8b98c74f7f5c
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 640bb12396e284e4d950bb8d8ec1f8458e4567ec09db92ed252275cae3718bc9
MD5 55901c5371798a10315e1f5a8b4af4a5
SHA1 70c7c4fbbc6547d197ac5cfb8781508f39cb51ff
SHA512 bffd22a93075b8620f17a2f89e34d183c290b8bfd05d628fb77961dc800fed312cf7e3107fd74d0ebf47adf0c73cf5fb6c4ea2959ca9749313f623bf77ba7148
TLSH
T1C1E02BABCC11ED370CFD176970548647EB44135B2B418C5B3A3D824D4FB1677018286C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 2aa68db17d5e375b8c5977c5fd326e0aa3576a4fb37e2be19026aeb921235d02
MD5 55186a159b426f13fbc9b46c59050201
SHA1 846b1514c7a2cba49fbb7a6b94862eec46a44c13
SHA512 cd59e08cc4e4b95fdd94f25ea1beda384500ad22ef3dae271fe9d2dd477199bf46f028fce7f45e051422bcc19bf2b53b3b2c79899351f90037546783e449cf7a
SSDEEP 12:d4YX+yTSsszEGD5h8SYjEG2e/bmiWIJYwPOQBia:d4YdCzx0F4E/BTYW+a
TLSH
T19113D17D13952953C348537E754A5F70D3FCC55E869E8153517B765C3501711131F441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 a2f545da8b4bb0a8c89b4720d4eda5cca69676f9004f75838ce634431f1de1c9
MD5 eded883b020dfc3a6c0f8471136da77a
SHA1 38c127939f74c72af4dd8748a916587d851e978d
SHA512 8cb023530dda7561db9fccd3ad057cf0576f39455b0b5235f5c82aed2b89820e5efbbca28f384720e7269fd05ce6cf490b28b4edd370d412a3a06aa433056509
SSDEEP 96:KR1+/gloGDWFaBF0sPDqSCywt1ughr1jWZ3VOLHKWol:KqCVTN3OrN143Scl
TLSH
T16344D8F72D18EDC3EB29CEB16C509138CD325A271DA5ED33F63940A216495E3312C766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 e975a2794647ecebbd9dcb58ec3eb31142d819c9336d83c22f0529a070833e06
MD5 7522e37b804eef848fb0b4dd78d578cd
SHA1 b6599d44c2391d841f629b3cb485c58b85e94217
SHA512 3ebfd5b22c91551f661687326018b3465d4ed0b06db4cf8bd20b72d428d9fab628c94144ebbd65d7e44b71c26bc378192ce13709e638965e34826dec52cdbd24
SSDEEP 96:nGaFWJo9ADGmlYVnD8YT06ach+Ok+2MM8JMeK7SGb6KKpSV:Gvq9HmlMwYTVCasSxc
TLSH
T1AE255CD1DD7A9E02D1FC197A1DF0E530366418BB70C3684068AC26EE25EFAB29C05199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 701fd075cad04268f9df36ea7c2605aa05119e74a05167283a441f9c51cd6ccb
MD5 5e74846327c36fcdc4c0e017977db5a1
SHA1 327b38a3d1a1b9afb5632ba60d2bf4dec7e7b2cf
SHA512 6a58d2808e6620018f7ff6917ce787c33eb7d24788e802e78ec2395d096c4a4877043ca77c3f8391b3718e88ad83340e9a036e15e615e2b010bbaac1d259dea3
SSDEEP 768:1fDPLSgcRUv+v4ixi4ixA4xPxh4/U4O4O4c4wz7o4R7o4X7o4:I0O2PpfL5no0oOo
TLSH
T13D163BA70F28A542EA86EFB0BBCDED1C7C702291FCD3A892E527827945F1BC4178515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 35KB
SHA256 4c5415769856d7d6dab0bff96c713e76aec8f33248c91616cc491e87b2786dca
MD5 c9cd5dd88ef56d27acbe11fcf655d37a
SHA1 2ad2fa9d249bfb81244183e9f9596ad8c7d3e3c7
SHA512 ba8b83119c79022d3511a491a1d4c48d46a2a7f7ce9165a0b135c6620928ef958ce43517838a48ccae67699a953d09bd828a64fbc536a542f5ea45e4bf0340d8
SSDEEP 768:IT3QZNOkF8SPVbI3zdfLk0Ca9QGwyov/YmAh0rIzZOZlG:Ib1gmzdfLkAQYmAYwZOHG
TLSH
T16CF2027818720C22E40EC3454BA64EAB7626196D55C2CCF644EFACEFC8C7F1992D7356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 67KB
SHA256 50f31d19b1aa0b5ef65e000533d4dbabb9907befa07b6f0ebfbb11d2597c8b83
MD5 df1ca1e1cb004574d666faebe5a13445
SHA1 1d6395dfab6df8ad8e1bad4174bebc7d4c28d8d4
SHA512 c114db5c2a47f04b6c4da4c2e9f5a624ba6c60d879c167a1c5b4818d39b03299dd63d25eba18d8f400e8c6ebceb64a31c8fdec49310765bb399f371d6a2b77de
SSDEEP 1536:bdywojyhnRExdFcIdsDzFgr2F066INt7VdzQSDantp:bOMnRExdCIds/Fgr2O2Zc4antp
TLSH
T10663012B9A0161FBAC35C4FFD6DAC47A9605C78E3D6844FE46C0144E27B5B8E6BC034A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2084e2f5b23a03baa8ff84a07c01ba3efba7b7b6f23cd4c0b63e1c4ba38653b5
MD5 946016a8e9ddc5bc9a5cc741140bb915
SHA1 002e5de7fa3fe927b0a606d63860c2c0071bba61
SHA512 79bec8e85211222d48af0a4671a25e19b67ab44f4453be66e25304945eda81923e9a2efbc3d4a3d64e1ed663a42390a9264957bc5571eb835167de16209390e5
SSDEEP 96:pxS4LEBrYNiUPboa5NGNLgGqaG74/1vz4tM3zt8fPJf3bKDLTwGsGRZ8wv5frgo6:pxNLarYNiUPboa5NGBgGqT74/B4tup8L
TLSH
T121918ECC878B83DFEB69883D64D4B85A74FC41480753DE064B5CE0FC94C73D06A8802A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
Size 36KB
SHA256 4f0fe8fd1a87324de46d4461774c07e72302a67457cf58156a0654bf8ea9ffbd
MD5 0a8bfc789a4940fe29a0e223d2bd75fd
SHA1 09fa2376dbe23615bde37c58d0e031979a9718f5
SHA512 0afe9a6ae915164e240b2c0aae5b54323c565edd3e0fd9ba1fa42e827d1e2758d83797f1e662197556fc20ec8ab0a3aaffa3af5817c5dbadd56092c7c1d6ab40
SSDEEP 48:TJqQq3qhmr/O43b/Y8uaLNW9WjWbfl4pwU1cx2B:tCEmrm43b/LuaLNW9WjWbfltxW
TLSH
T18DF22F078E393C61E4CA863B89C18AE70F790758935B6E6859A804615EC2A4880BF0FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 9c43383525d6492e478fcef08693260365ae8c70ea414130006ad515ae82be81
MD5 522b1b0022706d3e8060c2d860db9870
SHA1 58176d1bbbd8155ea3fd2c5dbae4624bc0fb633b
SHA512 fd1963d5c95afe0f7bbd26f69cd2af4fe3d86323f41499cccacf7cb956d5ad75dd56df88c2827a8b19aea4702fb0b8fd2773f62d27168fb1835ed54abc5ecc44
TLSH
T160E086563DC9D56D54D884B78379630ECED43444BBC839921746D44531C250866952A2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 1KB
SHA256 0ee42bae73e326e6f22dfe66a1211afdc3011cf4fc38ec2f398885780ef84f18
MD5 fd007c1cd1b350a74ce45173da313b84
SHA1 a798cf1cbf12767fdb3420e7375c15fc40f3c5ed
SHA512 f4978bb5c591f9c5700167e281af961f105ee1ff5c996b7072200fae53b15b3731b45b826219c1c67e2831c6e40844abd188e043ce2c53528203a0b4432ca565
TLSH
T1BD317D3AA7D46E47C9EA2D73FD0943931736C04982E5C47747F994E50DE0B150E2A0AF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG
Size 327B
SHA256 9387f2ec94d1e09e6d8b6907ec612f9ab540ae8cb9f2b4fa01260acd3ea4eeb2
MD5 91580d578c88b7403ac6dcc85f1f3f06
SHA1 f2c4d878438a5b86870fa7b906ca1a51fe23bd2e
SHA512 8d3f4d0209e0e65052d6d8098c8c443fb8bf8d746f54704f6525fe9201361ce91265d5e2a79bdd136d749e4aff72ab723594edbaaa8ff12de3a0589a4b8cf589
TLSH
T173E086453CDADBAE56D890734AB4A31DC7D03509EBDD26D22B0598541182514B29B761
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 305B
SHA256 dedf45798cc8a5d455934a6127dbf03f67162b2c3dd2289ef1c2712c78058b60
MD5 d36d04948c2589b5315a15c3be65d545
SHA1 aaac15daada28d1154e7d36bbd7a0a67c0b30b72
SHA512 c0f0bb2d1d080b7253ba088b847414daaf2dbeeed71a3a30d366a831223e315eb0bc0252256c70fb0fa410ea2d40255b5f54d960aa6c01cc098a137f1b8f1dda
TLSH
T125E07DC538D8C7BEC19C84734724A30DC6C03440E7DD3FC26755D0449082D04A3C1762
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 1e1e384c73ecc4547a073cadaff5b0f6815c52b3738c205b6ab9168e85cff8cf
MD5 799c14e852cc095222b82ea0c0591505
SHA1 dedb7a59e98c0a4ac8c032b978b740ccbb51ef7f
SHA512 c251b602959588250c0a535337fd2b0a7d50147de4326edcf8baf9baeef03e0662767fa7413107c85744430d848153c324591f88e9fcf661874a2b0054063de6
TLSH
T12BE04F922DCD96AE1589806B9364731ECBE07405EBCD3AD25B46E486A1C6508A3D16A3
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 bdc15dcd187290be2cf06b5b988e4e8cb9798acd3e4b99d581338550dbaaafcf
MD5 3eca9708bba920ad9d4a0322c96b107d
SHA1 24dd0cc761eb47aae5ae0e2be5070697a313dc71
SHA512 273fce6170bc4ec2e2df99691b5ff82b1449615ea6d827cb975143c2912f414eaa6c33a436faa19007a862a74f581bbf7dea5176bc4d103a7e94c722f0985adf
SSDEEP 24:TL/91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB4Nd5hVmy5/zTypDrqrRAj:Tb9aw/aHLopFMavU1iB4NH6yRTeDrqm
TLSH
T11792E1CE1F303310C4F48776E9C2099A1E7D163CA363AADDEE5054F2CD8349BB5065A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 3b5256ca820788f9135d491a032e931a098da437df040df869ea44a28e8dd06d
MD5 fce760de123c1f5a1e3cdf63966c72eb
SHA1 21f73127cbd8b93c6196b8af1480026d0305906f
SHA512 f05258ee10e26ff7bd33386b9769a8444fb18bca902523a60a63281ca51dc646e550bb15dd16ae6006bdf7a71bd7dbad0b93173f21f18a8cc4f516a27021dc58
SSDEEP 192:DR5Yz7sO2mSmSaIaaEqCcETdpsmmOmKmDmzmcmmmf7xZRHPQM:DR5Yz7sO2mSmSaIaaEqCcETdpsmmOmKc
TLSH
T101F19AF7C7E8852DC91156F4AB15AE2FCE2D0A24431D3C66C8E4AF4B93E2872D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2e2a0ea6ad099333a0ab75680607a2340bf306cb5d88623f3e5a50ce49fe2093
MD5 e40e919ad216d967bf94877e8b89028a
SHA1 30ecc49006ed35d10d0c3432976d4ed57c63a763
SHA512 a3e67505bddd4cee51e2604dffc5acf3cfb31719b577bfe31768406d34c0705895712690adea4600a620c127d722a4a0c239be649d4d49383c60b1d67411e1ad
SSDEEP 192:Dkh1mtixNmpmEwaIaaEqkcUSdpKmmOmtmDmzmrmmmg7Ed7rjhn5o:Dkh1mtixNmpmEwaIaaEqkcUSdpKmmOmw
TLSH
T1EFE18BF783E5852D8A0196F4EB15AF2FCE290524431C387688E4BE1BD3E3872E25175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9aebda4bff74c2c202a6d5d22d11f4d1f58fd66a179ab326399b3176cf3c5c96
MD5 36337ec2927d4ad6a965f7d5ba6d7a26
SHA1 074f712abbfaa7899e24dde80ec5b9658778b63c
SHA512 84bcee360aea67fadbc855198fa298b45ab117ee4816e259e20623cfc869b3a3a9d69125241ca7b291de47def1205cf96d09956d7141d600265e192651036853
SSDEEP 192:DR5Yz7sO2mSmSaIaaoklBqCcETdps1NmSHmKmDmzmcmmmR:DR5Yz7sO2mSmSaIaaoklBqCcETdps1NE
TLSH
T120F1BCF7C7E8852DC91156F4AB15AE2FCE2D0A24431D3C66C8E4AF4B93E2832D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7a19f38f219d38a12e89cf15107e7b876c1f2ada34607e2eb4833760db3b8aee
MD5 0451a83c78dd7685ed2ab672ce68143b
SHA1 b496d75a8beded2bb813a5f40d321fd1dacf368a
SHA512 bee1352a5f2fbb7cb95b6219e3ac672373ffca3011fcda98712970607a2ab5d38ff63f13e00bde1fab1e5d593114717cce8161db178deb7ac54d45c5dfcb4e61
TLSH
T14941AEF793E49A7E860192E4AA146F1FCE6D0925131C7C62C8E4AF1B43F2872D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 c56bd5461dfc46a15215b28a4011870f4b22988e54e748a51d1810766171a2a2
MD5 e4fd6bccfa1f73960de6abd0c34153e3
SHA1 d843292f603d6b860d0cbe63a0bb2ce8df40fca2
SHA512 6e72c0bb547e83556c746133e0217fea7fe565d976156e873bfb97ee5fd6b8159262a5f289e23b235a9b810efb466a9fd06f2a29f7ca65f7696dc7c7d2083ef0
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBLRK:OIEumQv8m1ccnvS6F2Vt
TLSH
T19DF20FFF1B09B601C0D492B4E5810ECFFD6D112D4B9ABEC09A9808F357C66F39528259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 19a24b0931e9df546d43a2806c0e92961bb0a399a5b3e5853ebac63957be0a04
MD5 30a609a38c4219e6f1cb51c8609ea409
SHA1 08268a18e911d8f428f1572b346bcaa733560614
SHA512 ec9b967445e514397535f94bd3d2d33793e6d354425bb363e07a4baf6b65fe73f0d56aa92992aeb672f3a8997bc887124ff205959df28facbbd9e8b55b8e2025
TLSH
T1DE31AF97EFBA7857406C4AB71E0478493979B832029169F8DBA7C16C70911E70B12436
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 9b87eb17c7f90ee912eb334aa0ddcfa5688da64e924b15d5d572d2c539eed817
MD5 345750c22a8ec85ef820d1489de6c707
SHA1 f4d81f7cf19ea67e9cade35703112b3caa3e8300
SHA512 a5f77d8edebbda901b754778a9a04b3d8ae327123a555fc2c213e65106a03744d7b8469722f3a7894a3b22c875a0ae94b56bd8c0e207014ac5469830d72fa2a7
TLSH
T162F0C0EBF7BA756700B844AB5D08F8895872A43102D014F0CEA6413CA0955EB0B02053
MD5 SHA1 SHA512 TLSH

Submit Download

e4ac10d0-a47e-4281-a7d6-9b17a5001e58.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e4ac10d0-a47e-4281-a7d6-9b17a5001e58.tmp
Size 8KB
SHA256 d09b71418aedcb1f64ae50597f616d8c69862e631b51675f7f877b15d18bb19f
MD5 fc572a13102208f154cbfb42debb5057
SHA1 9392959467c9791080ab97527a437b20b54ec41d
SHA512 2799a5be379b6b4603867342fff4130419c66dcb74a8a1cc45c9716134a295b9b4dc4d1777d0e988e745126d00afe81b6f0a4dc0e4947ede1065cdbdcea45ab9
SSDEEP 192:DR5Yz7sO2mSmquaIaaEqCcETdpsmmOmKmDmzmcmmmf7xZ7rjhZIo:DR5Yz7sO2mSmquaIaaEqCcETdpsmmOmP
TLSH
T19702ABF7C7E8852DC91155F4AB15AE1FCE2D0A24431C3C6688E4AF4B93E2832D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6a6b76559e11985ee3fee5b2d42c53c6d5b907b9fab5653d69f084150b4dc7e2
MD5 507d1e454b79aa8e4104c8fd5940b9f7
SHA1 2e9650d7b0539efce7f24864178fd3a00d591aa5
SHA512 e1d3f6abdb4b94f3a94d064c9ac277d533e31d64c58215e16553caae1cda739158debaab976671eabc7c1a03f75bd540fd400b32481761370732ae51a5c2417a
SSDEEP 192:ORrdn3q5AZv7spAPRp229AHsb+WNnOk00XPyIsnAUge:ORrd3r5gUX92w50+e
TLSH
T13632B41EBD24793B5CCAD22AFA257793E3F5103160952E84E6FC8A2C15DB6CD322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cffdebef41603f4208322690ff1d6548d131a3dcf94350255a87f5d17f1d3574
MD5 71fb9f77ce84539d7210b715d7fc25c8
SHA1 023eed4c0ab66c28210883c5739b8cbbc9a52f82
SHA512 3db7dba3234c568ee06d690b4a7ef4a01cf3138fe1520dfbd9e5f57bbd11a4f2c55453a1b848e23a33fa8db2c8f5bea69fe22d41c08569ed9840fe43b6bf4ff5
SSDEEP 192:HRrdPrBEH51Wv7shAPRp229AHsb+WNnCJnp0Rkw6azxa0VyIsnAUgtaJ:HRrduig8X92wsn2ayaw8
TLSH
T1D842F62EBD14797B9CCAC21AFE257757E7F5103161992E84EAFC8A1C14D76CC222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4e0364866e0abf8a19c7f43bbc8c8f9a31c23fd83449e3ed37a4bb0e626966ee
MD5 4ebb4604bad6384aad242f3e113fe273
SHA1 3f4bb6ead6df60e5dd95d46969e668be44c05649
SHA512 69bd06c7300ffcf3f96217c9656a92e97837d8b681bb95505bce2226f2aed8734bf0d89e01543a5666bddc5205885c59a7c9675f0c25ae1ee60676575fe0ded6
SSDEEP 192:NRMcBhxRrBEH5qWv7shFPRptN1+j89AHsb+WN+FdiXO92i0Rkw6azxaFVyIsnAUp:NRMmhxvigPXh2wtM2fayaze
TLSH
T14E62C52FB8102D7B9CD6C21AFD25BB57E3F11021A1995E88FAFC8A1C14D76DD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1b288d6c5f8c15707bc62d9d5c2c313e53b28b984acaed0781cbcff6d27b7ba6
MD5 7bc0f631675214da42afcb9e5bc4a4ba
SHA1 525fbd144164367f11b3dfe4424bb03777fc2672
SHA512 b2bf3323b9be48e602ee953936af115268c46c6da02d5eeddaf239a15ed5e5b6f6f1f1069f4a2c908863db3de8c023241b651f9096d51df853c8dcaa3246ca09
SSDEEP 192:HRXcBhdPrBEH51Wv7shAPRp2n689AHsb+WNnCJBO92Z0Rkw6azxa0VyIsnAUgtaJ:HRXmhduig8X22ws22Gayaw8
TLSH
T1E452E62EBD24397B5CC6C21AFE257B17E7F51021A1991E84FAFC8A1C14D76CD212742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 44ccf7add78aca23c21231971ea2ce533bdd44f01e35e552d7a3e4bf0149ce48
MD5 e06735020a54c952906ebeca6ef0ae46
SHA1 76a3d68850e528f0565538c439f7492684794764
SHA512 41deb0c23244d259ee4e6b4aba3df864489dba8a02f00d4192ad1637ec4d2809ca5200426b42d6c0967bcac0e709414d06195d5bfe99beb92e32155b60b007d6
SSDEEP 192:HRMcBhdPrBEH51Wv7shAPRp2N1+j89AHsb+WN+FCJBO9260Rkw6azxa/VyIsnAUp:HRMmhduig8Xa2wR22nayaZe
TLSH
T18952D62EB8203D7B9CD6C219FD25BB17E3F11021A1995E84EAFC8E1C14D76DD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 417a0578ea4b54f828ecd2de75543270d0c666561aff73b23e3f34d30cff3225
MD5 165b0cd530b08bb07df05ae4f2508f4b
SHA1 ed714b7967a8f3d3495d511e897cd6d8898569f8
SHA512 5145661bf5d0e014a224ecdafcefd28bd7734d46e0220c7c011e5320f9d377a4ca0422219a939509fedd7dee2dbe2625c4fda3f4332c77acd9420524eb840d02
SSDEEP 192:NRMcBhxPrBEH5qWv7shFPRptN1+j89AHsb+WN+FdiXO92i0Rkw6azxaFVyIsnAUp:NRMmhxdigPXh2wtM2fayaze
TLSH
T17162C52FB8102D7B9CD6C219FD25BB57E3F11031A1995E88EAFC8A1C14D76DD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6735edc7ae84b13eaa0ff63872735d5642a56150c433d2636c9f4bb7e41c9925
MD5 db9a80dc9737ecbb6bb802f7bde785ea
SHA1 0e0b18d32e7a3e8cbab5a82a018b4ffc50806098
SHA512 603bd16163fb318f8ba17b7547a4a14bc392130ed001ee1e3b488dfe26e4f624f085540f64d8e414bfdbbde3314823a0da9cc4802adf8981c3c3961d236c9c3d
SSDEEP 192:NRMcBhdPrBEH5qWv7shFPRptN1+j89AHsb+WN+FGv14O9290Rkw6azxaFVyIsnAq:NRMmhddigPXh2wFr2iayaze
TLSH
T15662D62FB8102D7B9CD6C21AFD25BB57E3F11031A1995E84EAFC8A1C14D76DD211702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
MD5 191a425abbe14997e55d6c34d96395de
SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
TLSH
T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 9f4e58255629c46d36ab23b37a7f5f89a7c7efb5eb19b06675dae5b6cbb1ecaa
MD5 95316e88bdacd0025fa9fb995ac31872
SHA1 8f3d6d3cd4fa63924f0cd4480d9f370f10860691
SHA512 c23a251ed764570960b42560c00e0ba62a8730856e3e5763f9a438de8b51e67613ae097fe10de11851fe5221b33d24d1852cabedd3abaf4ee93b78ceeb1960dc
SSDEEP 96:F1mKpMlRwcnDh1J9SamLXbXFXKXTEFXSXT8XFXKXThxhXsXU0XbXNXKXTzuZXIG/:F13CsmDhFGL1ajGCj81ajp8rL9ajY4G/
TLSH
T177A17C6EB90A084FE4AD4937CD79571B6F69CB0C27FE3767A9DE8A0405B0A5711082F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 01b0460f7987af3630cfb6cdd53e6a7730d648df002c2f49b3f7cb4138574413
MD5 487f218f41dfd273c8c609833fd6c014
SHA1 987c2ad58860b39d8fd7e8ede75eca6bc887d2ee
SHA512 01fa99c533fe31f3c8f14f1af36f906ba9d98f102305e1325eba13fc5e01c6972161d17b05ef4add9ce7ed1cab5b836e57061114632f428340f533fac8adffe7
TLSH
T1A4E04F612ED995BD549980A342A0E30AC6E47405E7CC3A962F96D54611C6908BAB3266
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 529f9752fcbb52054dc8dff42ac3e40ef661f0f8527c7dae8a2ca05818f8a895
MD5 5999c1fe257b73eac6f56c22fc50a924
SHA1 595bfc991f88e15a64590e15a7d90ec7055b0a07
SHA512 842f151b9d7967f9d0b49bbcd8f37b3b451e1f97f537522dc3dbe1f4ee76bf3821251d3351ca0d4e98208611040bba7286c63031931b33efb63bd6348f231c72
TLSH
T136B0121280025900C14302B86183148822889F349605130253E06975A82A1B14014190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588e7f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588e7f.TMP
Size 96B
SHA256 5fbf4d74057578d5cb8fa0b498950f1cf8ac2d83c516ec181fade0697bb3bbfe
MD5 7a12161bedff202236f0221ae9a633d8
SHA1 2309f1afe440b7f78a80d9d542387d725fb9b1fc
SHA512 431af2326cc52db80541b072a4ce6c6bd98dbd226b399eef906ad3ef1ce285a1589e732a5265542cd0bc6eb4aac96080f11b6b5514d4044ac481eb6c6b3a9191
TLSH
T1F2B02447C1011101C04703701144C0D47150FF14C703014141F30755CC115F00110011
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 308B
SHA256 cbee1100a2c9add47776b7e416b58a809f6feb9fe458bef8185b0c176b5db340
MD5 4e7982b86b3d7d916b7722aa3b3f0669
SHA1 ce4e874903cb71d9012cc7654ca7a6ba5e4f7efd
SHA512 c4dda8b36e90a327061dab901730f47fc23cca129b02a157f1ed0c566a1d6dddf272a4e74d3acbf14eb3a7fac0820387a584db9e19ca299724ed7f3030f891bb
TLSH
T1E3E002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 1f53691488fd005ab707c1c9be5e6917a16ae86297e46744aa0fe6f4fa18ff05
MD5 6b9d779f147072d24230377c120d2bab
SHA1 7df58038fda146860c43a6887dd565025ed69eb8
SHA512 fb7e8b0d121cc680cfa9f643f880cfe13415e3d909567ce2088f44745fa7a0e89ded4df1649426d0f9a4bc028b539d5de1b24098a3c50ea88782384db1e1fa61
TLSH
T12EE08C693DC9DAAE149980774360B38ECBE07407F7DD3A921B46D48A228650863D26A2
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13422298682921653

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13422298682921653
Size 2KB
SHA256 d8d19afc6c6849cd3ad0746420af7b45ee79253f6ba49d29b2b7eefe4181dc2c
MD5 6f38e6f19f1221fe43199a89697f28e1
SHA1 22e9cd152beb6d42653dac03f4899c61940ab0c4
SHA512 42534f9026422b2f11f845d74440a23b8e2b1545aa49fcd4f917f3bc367dd3cb537024ab20114310417448127b7f34ea74a426d78f200cb7db906aba0aafb73f
TLSH
T1E5517F6659D4453DE73F8238CB7631E7AF35B60230458D1FA02292044D63A439FB0E9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ba9bb62b7b4a418bcaeac390261c1e17bf5871a406d7fe3303474a57d009b7a9
MD5 0b4e49d58f300e7c5d07a06f4c14585f
SHA1 c010d589ceea7e5992f27b3e25781e1865cb3edb
SHA512 6cf72f78cf56fb3b4241a6122e9198b4c1e141cd7b05da5c52b230cc3256d9b523c034ae669072351673e4758cb7120224f77dc95a72ce9dd1c57bc26ef04d41
TLSH
T15AA00211E1501001C22142B02493129023A94D26424102C26996044CE8B45409151111
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 055632238dee721a223cd56d65c344b66ac7b8f2a05235356e776239daa98310
MD5 9906eaf01580f2a3f099f2c768f98f49
SHA1 d8439aba4bbbde84df774b519c0ff4a7f94fd297
SHA512 7c919f504239746e5dff59b896cdebb68e2f1749c7033021969ce7118f640ffaf445e6d12558ee7b0b0514a644c5a575109aee1cfa4d9491a6919e4e134bb76a
TLSH
T129E0D8223EC98AAE11C940679338F30EC5F27402E7DD25A51B0DE044628B4047282252
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 61a75110a8ecee80c870ddf869ae705764f64329d21ce0dbfa88f1fe329b6e98
MD5 8e06c31abf63d258ba6eca3dc00b05d8
SHA1 dde3466b4c71200de123e08a0322950d6295373c
SHA512 2414f471cc2edbb7c61ea9c7e8e83f86c61ef43655619852c8c98aa113fb27f6d8d7991960123eb45a1ad6aa3df4579402e7bf3e56dc75264fad5301c278bd1d
TLSH
T161E026713ECECA7E0488C0A38364B35FC6F07844F3C936CE470DD0446186004A2A12A2
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 8b7b927b9aff61970557b8df20c6495d3f632638380aa6dab3b41c012908724b
MD5 2fae0b3f6db0bcf3077dad6e450c2c4b
SHA1 56660146777883ee780c8cc36ebbaec4d7aace08
SHA512 b260184cda9fefd8c46d7478d77bbd1d33981a06dc874c2221da7e5f3a0f5a0d4bebd27f59a081373b14c564599bcdb8656d70c068860adbe794f61c65de799e
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OzDftVumJnSjG:1nbZeMrv/hGtz73nSy
TLSH
T18DD3754B3A747002EDE59A7258E050BB4E3CB16D8F51A5D5387620688EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
Size 4KB
SHA256 83d5e07c2c0be86be63f784347f79811b94b0214048efdc9fdbdd7738a8ee062
MD5 c6a144624c9736c864d175e41d771aca
SHA1 791f9a1442b4e352f06d5da5b40d2a570b8aac4b
SHA512 b4153fd326964cbb1df91dbf2b9aa5edf2a6c6d631da5c55d307bc85f91c505ad65d02c4fed3680d55d4e5d8e904baab74699a4a53d7b89df944769ace324579
SSDEEP 48:weNJzGDF1l5MYOdq+4LWSNm6zgaMXBVwWOquu3Br3TL/eOEErjQ10wY0wi0wN0wG:weuDF1lSYYCWs3qvXf
TLSH
T1BA91EDA336D05543F4FCDA7CF8977A4D5715A141D855E2FC507400580A66F2391EA4FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 cffb0a26d9b84efa6532ee05af711767a1d2f3b43e7a9c831e36a6149ccaf1f7
MD5 3fc30f263589762d6d349d17606d5453
SHA1 753ed42d77b6d4b2cabe5833c0c13587dc048031
SHA512 27a6f4f865e717873b501d1722ec0c77c0b6883ee3d794b5247b9d3f788e74ea39787a16e7d07e3bd8f7a0b5d6e8f084b0916097b67faf0c36a4acfd8d7097ef
SSDEEP 96:f7doKsKuKZKlZNmu46yjUKVXwX4p+XvX2Z:7ZT0nzXggTfQ
TLSH
T1A003618F662880F3E0BAC23EEDC249D6FC3C110CA71379D618E947694DAC03390582AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 97b1ba14329b5bcab353a33923432e8c28676637353d388227f0caac1820cbb5
MD5 20dad163f6a00ac1b46aa2894bc8e3d2
SHA1 ecdd2cb7300f4df03446365c22699c3cf556f02c
SHA512 2085553d96bc18cbcdb0711b8fff515e374af8841fe35f79321f05320baef397af4e6cbab959e8b3b0452d8ce8d062973410653285f1cafb71eecf69bde027aa
SSDEEP 6:oD1llqVkf/Pt3T++Bcc/XKuqHKu42nBVz1wnyCc/mLEJOgLEJLrh8a:oxXqVknV3q+BXXwX4qwimLULIt5
TLSH
T1E302D88E7405844BF828033DC99D9C562E2909543F43B61B18D5870D1878127804C3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 ec4ce30c03729aca6580fec575f3f7b05ec39335bf69fe285c437ee58193ae29
MD5 095a099073da0364be803e6cf0953560
SHA1 75218ddcbdb30fc7ce0774ff2483943c75f1acbb
SHA512 f03cf8aa488e35dee36f8a09293eb7852c0506c95fabd0bedcbb0011d140a36c8ab06362e2f20da350daea422e22019186f000e7a4f829cf74f3b522635f3ba9
SSDEEP 384:V8dCsdG5z1rXsdQvIIIebOMIM1BX+gfsdG3DOeu6sdGiuKJRsdG79:P+dQVsX9
TLSH
T17FA2B69673F43B87CC9F9BFBB8558C3E17F2AC8A9C5600116095967A3D23E07498139D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 f73a8aa2ebe107f781a819b58041cea5cd8a04592ddbe8a02c2f244de7eb9303
MD5 c8babee7d5bf1a5e729fdde663e98f91
SHA1 8187a758b266046ae8b3ea75dd8ae208438787ac
SHA512 ce0b2579465bbcaf001495474f01370e8f887adf1e5e87f93145533e8bc70b6d9f2f9df5eee09b4874b35620ccdc7a11d25e7f98a7473086c0936a2117b58616
TLSH
T1C2E086627EC9D5AE64D880AB1275634ECAD43845FFD835D61F02C44961C650866952A2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 46a7474899d6641ca425084d7d571fe99f700fe2ef52e7638846cd074b3e3abd
MD5 d128205d21269bb6f62c5ad440a8df56
SHA1 cfb0adc9ee673d93a7a33401a0f9195f8b0b1c04
SHA512 39c039c8bd36be4145d3d4c9ac7bddd4a5eaf8ebd5a96d81fe96eaf408f8ca02edda45046f1103beb6b71e47c800cb46f6b78ad8f9ff80aefec4c1f13ca339d2
TLSH
T160212895F330C104C289477B647F6B251778D4539FB8ED1F55B920693EB2E440E472E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 73ee3d3fac8d9f1cc5bb2b437356f2035632e84396fa7952eebc6a220ee1f0d7
MD5 576b2d6bb65cf0fbb77db286a27fa594
SHA1 986f53af2486fe80d5fb360db05baeee2ab7a15e
SHA512 88e38ce7ec60df778d261836a98cc728e1fc384c51240acfd1426c6c663a32f436e7c53dabe63e48f111e0e4803fd45822b8689ea8dd4cd6dcd840b19620d152
TLSH
T166E086627DC9D5AF54D880A70275A34ECAD43845FFD83F961F42C84961C650876962A2
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 9462ce0d9652c2eeb171d5aafbd10223a367957b496b7a7548f140826a579b39
MD5 a7c42e0db45b4e0d3fe4b59d2dd29dce
SHA1 b7ec12ac4bd69458c1901e524095c81728c3463e
SHA512 fa24c8f6457723f3d0def240e4e45ee1d2361cfc509603e28643178a4a21adcf093cc10ec4f209c11f3fcbcd655d18c282a3822ef3ac88bbdaabe1a122f32cbc
SSDEEP 3072:/CW0SJALlOzFpk9UyD1LF0u8J3kXLyZeUJcirRUhZtM3:/LqlBiyDMu8J3k7BUJc86Hq3
TLSH
T1CFB301B22F87542324BC2759314B38075FF65A83AA5DBDDC8BF45BE6029B2D03797902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 113KB
SHA256 ccf605dab862614b694fc3da6bd30c809355c73444074df5b19becad14fafa48
MD5 2bdc04341f9ce68f5aa8db752e4d59ba
SHA1 419dca96cde40282e597c5bc206334c4269a08d3
SHA512 94d58fc2f083be2343d909b712369a6b3b97020fb03aceb7e0a2aeb1544f8c41736825e0fa356eb3354c9536167daa0b4f165c951b0c48882c07cb1ae8f2b4b4
SSDEEP 3072:8MW0SJALlOzFpk9UyD1LF0u8J3kXLyZeUJcirRUhZtM3:8FqlBiyDMu8J3k7BUJc86Hq3
TLSH
T188B302631F87143324AC2729315B385757FA4E816A9EADD98BF04BF706AB3D13397902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 113KB
SHA256 b9879e217f941ae842c05694395bac0269926d0e8263c437111ee1091e817d89
MD5 6e597310413c5c9627acbd58226789a6
SHA1 a9365a14fa2c80bb85c835d2cbe0387f568f840f
SHA512 5c727e731db7d577f78d22ee67e037743e64f0bf6d9b2e9f4377fc9fe10c52e1b7d376fdacedecc742585bfc9bb1a01e791d6f557081a573579d3458fe1170ff
SSDEEP 3072:bMW0SJALlOzFpk9UyD1LF0u8J3kXLyZeUJcirRUhZtM3:bFqlBiyDMu8J3k7BUJc86Hq3
TLSH
T1BCB312621F87143324AC2729315B385757FA4E816A9E6DD98BF04BF706AB3D13397902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 ff7b273f81d415b227701b15142286260b07d820bde5b8ff342efc26e134e4e6
MD5 455ff7728de2368df11ff50e83b2cf77
SHA1 3d452a6c5df70e70db4d06e93ddc532eba65ecbc
SHA512 671f8c05f4365e271550b243b97566346ac437aebe6ad10d4ea83bbbdaac13428cb75d7ebcc2e3b1f202a9d28a2cd329281bb3cb14a5131403c9a7e51119f93a
SSDEEP 1536:4LQP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gW++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1889312B9991E7D39636ED396A0079CAC8CD3DCCE151051BC30C76F0E14BA3A3A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 b3c4c4ecf06dba437d8d2c98c12298910026c1959e56b04cd6b3fa2dae68c4b7
MD5 bb5222cf78497835e7937bb177a764d4
SHA1 417ae8686ea3966808fcb5210cc04be20828aa01
SHA512 1eb2d0a136a4585bf05e740abaee1440bf969f652d9321c520719c54071227a8560466d8260b4a4791f901cb0b63b256400be9f38b38908977d30f3fe67083c9
SSDEEP 6144:BAqlBiyDMu8J3k7BUJc86HqF++JjcMW2VcVLlf:BFlEN3k7GJc86HcOMWjf
TLSH
T12A1423A65F0B3832219C97AA611B7CAD06E38CCD161D68FC12E15BBB05BB3D2735BC45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 b6520052996501bdbe824154e297f6340cb75f4e448b8131ca63c6f2e7a6db06
MD5 a368ac0f5bd944fa76374e5c6e38832f
SHA1 44a8f1cf3aee98a959f91518cf7abbc2b2d6120e
SHA512 bd4b30f6d3288dc1d35afdca09f02e93825bb0c5d55f5a3d94c7b2cadb8439ea465d4bad32b8c874df34166c4d429fbb3606d43d78015cdb8fce5dedaffd4789
SSDEEP 3072:bFW0SJALlOzFpk9UyD1LF0u8J3kXLyZeUJcirRUhZtM3:bSqlBiyDMu8J3k7BUJc86Hq3
TLSH
T1DBB301B22F87542324BC2759310B38075FF65A836A5DBDDC8AF45BE6029B2D137A7902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal
Size 4KB
SHA256 194da5929211dd71dd9291da74c083e2a0d47ea5b4bd9180354b4bb94864c4ed
MD5 b6399485ae4cc83fbf42639416f9b764
SHA1 04e4a0ee5b5799baf1cf5bb3dbefdc030f190ca1
SHA512 2fe68b5d8d235de627c8fe1b0be4c174145dbe20e8a8b701ca8ab5070524c5110bc1528dcce48abb42dc7b0ca33e8cfb8610289aa217e08c76b138d2347bc66b
SSDEEP 3:spHlFllQ/8QuQll/lDAL6SlreqNcSFYojpuyOV9RUIU:spg/ZlCzetGy2
TLSH
T196911243260089B7DDC4273F36C6009EFFB239100F81EC0440748C625784604761893A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 20KB
SHA256 25b1e50883644d800aa97dc2fbcd183a7ebfa85f8deb969af4ec5b60c46bb4d4
MD5 48011b40bf84c9f6b42fe42db4bbc0c5
SHA1 654ff1fbcaae5332338011af0aa8343a22189e3e
SHA512 c5ae13f6420844c6a29d8cc17ab27ced88d35463084f6fc34430000f994758eccdc81bd00942b5426dc3e9b3efbcb2db7ad6cb2da2aec4cc74f781cd188a20bd
SSDEEP 384:AJWJbVca12krtuJxpmXmlJVjeQ8RJo2rgh1jUdwWV5P1m5m+GDa50m/Sc73a:8+bVcWrql8RJhrgjjUdwQym+GDa50m/4
TLSH
T19E92497436F41319F3B29F749EF1A96A653AB866AC00DB5D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_guobsbbw.1ud.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_guobsbbw.1ud.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/620-6-0x00007FFF8DD20000-0x00007FFF8DD22000-memory.dmp

Download

memory/620-14-0x00007FFF70000000-0x00007FFF71619000-memory.dmp

Download

memory/620-0-0x00007FFF700DE000-0x00007FFF708E5000-memory.dmp

Download

memory/620-4-0x00007FFF8F2D0000-0x00007FFF8F2D2000-memory.dmp

Download

memory/620-2-0x00007FFF904E0000-0x00007FFF904E2000-memory.dmp

Download

memory/620-3-0x00007FFF904F0000-0x00007FFF904F2000-memory.dmp

Download

memory/620-13-0x00007FFF700DE000-0x00007FFF708E5000-memory.dmp

Download

memory/620-7-0x00007FFF8DD30000-0x00007FFF8DD32000-memory.dmp

Download

memory/620-1-0x00007FFF904D0000-0x00007FFF904D2000-memory.dmp

Download

memory/620-12-0x00007FFF70000000-0x00007FFF71619000-memory.dmp

Download

memory/620-5-0x00007FFF8F2E0000-0x00007FFF8F2E2000-memory.dmp

Download

memory/964-966-0x000002063F300000-0x000002063F312000-memory.dmp

Download

memory/964-965-0x000002063F2C0000-0x000002063F2CC000-memory.dmp

Download

memory/1304-1042-0x0000026448230000-0x000002644823C000-memory.dmp

Download

memory/1304-1043-0x0000026461FA0000-0x0000026461FB2000-memory.dmp

Download

memory/2588-1144-0x0000018DE4F80000-0x0000018DE4F90000-memory.dmp

Download

memory/2588-1137-0x0000018DE4F80000-0x0000018DE4F90000-memory.dmp

Download

memory/2588-1136-0x0000018DE4F80000-0x0000018DE4F90000-memory.dmp

Download

memory/2924-983-0x00000230D0FA0000-0x00000230D11AA000-memory.dmp

Download

memory/2924-982-0x00000230D0C10000-0x00000230D0D86000-memory.dmp

Download

memory/2924-993-0x00000230B8420000-0x00000230B842C000-memory.dmp

Download

memory/2924-994-0x00000230B84C0000-0x00000230B84D2000-memory.dmp

Download

memory/3552-990-0x0000028F9B460000-0x0000028F9B46C000-memory.dmp

Download

memory/3552-1084-0x000001A53E860000-0x000001A53E86C000-memory.dmp

Download

memory/3552-1085-0x000001A540120000-0x000001A540132000-memory.dmp

Download

memory/3552-991-0x0000028FB3B70000-0x0000028FB3B82000-memory.dmp

Download

memory/3852-1169-0x00000133DA7C0000-0x00000133DA7CC000-memory.dmp

Download

memory/3852-957-0x000001E1DA3F0000-0x000001E1DA402000-memory.dmp

Download

memory/3852-956-0x000001E1D8770000-0x000001E1D877C000-memory.dmp

Download

memory/3852-1170-0x00000133F2FB0000-0x00000133F2FC2000-memory.dmp

Download

memory/4344-935-0x000001674B880000-0x000001674B8A2000-memory.dmp

Download

memory/4344-938-0x00000167319D0000-0x00000167319DC000-memory.dmp

Download

memory/4344-939-0x0000016733790000-0x00000167337A2000-memory.dmp

Download

memory/4424-974-0x000001F51B780000-0x000001F51B78C000-memory.dmp

Download

memory/4424-975-0x000001F51B8B0000-0x000001F51B8C2000-memory.dmp

Download

memory/4696-948-0x00000208BC090000-0x00000208BC0A2000-memory.dmp

Download

memory/4696-947-0x00000208BA3D0000-0x00000208BA3DC000-memory.dmp

Download

memory/5144-1028-0x000002529B6A0000-0x000002529B6B2000-memory.dmp

Download

memory/5144-1027-0x00000252818F0000-0x00000252818FC000-memory.dmp

Download

memory/5216-1128-0x000001AADB700000-0x000001AADB710000-memory.dmp

Download

memory/5216-1127-0x000001AADB700000-0x000001AADB710000-memory.dmp

Download

memory/5216-1132-0x000001AADB710000-0x000001AADB71C000-memory.dmp

Download

memory/5216-1131-0x000001AADB700000-0x000001AADB710000-memory.dmp

Download

memory/5228-1133-0x0000021BB5AF0000-0x0000021BB5B00000-memory.dmp

Download

memory/5228-1125-0x0000021BB5AF0000-0x0000021BB5B00000-memory.dmp

Download

memory/5228-1126-0x0000021BB5AF0000-0x0000021BB5B00000-memory.dmp

Download

memory/5456-1058-0x000002564F9E0000-0x000002564F9F2000-memory.dmp

Download

memory/5456-1057-0x000002564F900000-0x000002564F90C000-memory.dmp

Download

memory/5564-1138-0x000002565D320000-0x000002565D330000-memory.dmp

Download

memory/5564-1143-0x000002565D340000-0x000002565D34C000-memory.dmp

Download

memory/5564-1142-0x000002565D320000-0x000002565D330000-memory.dmp

Download

memory/5564-1139-0x000002565D320000-0x000002565D330000-memory.dmp

Download

memory/5612-1152-0x00000203BF980000-0x00000203BF98C000-memory.dmp

Download

memory/5612-1153-0x00000203D7B50000-0x00000203D7B62000-memory.dmp

Download

memory/5640-1066-0x0000011D63490000-0x0000011D6349C000-memory.dmp

Download

memory/5640-1067-0x0000011D7BB90000-0x0000011D7BBA2000-memory.dmp

Download

memory/5764-1101-0x00000251AC3D0000-0x00000251AC3DC000-memory.dmp

Download

memory/5764-1102-0x00000251AC570000-0x00000251AC582000-memory.dmp

Download

memory/5884-1120-0x0000020772890000-0x000002077289C000-memory.dmp

Download

memory/5884-1121-0x0000020772F20000-0x0000020772F32000-memory.dmp

Download

memory/6008-1117-0x0000018D8A330000-0x0000018D8A33C000-memory.dmp

Download

memory/6008-1118-0x0000018D8A820000-0x0000018D8A832000-memory.dmp

Download

memory/6028-1076-0x00000244A6300000-0x00000244A6312000-memory.dmp

Download

memory/6028-1075-0x00000244A6290000-0x00000244A629C000-memory.dmp

Download

memory/6056-1010-0x00000293F2580000-0x00000293F259C000-memory.dmp

Download

memory/6056-1007-0x00000293F2320000-0x00000293F233C000-memory.dmp

Download

memory/6056-1008-0x00000293F2340000-0x00000293F23F3000-memory.dmp

Download

memory/6056-1009-0x00000293F2400000-0x00000293F240A000-memory.dmp

Download

memory/6056-1013-0x00000293F1D60000-0x00000293F1D72000-memory.dmp

Download

memory/6056-1012-0x00000293F0040000-0x00000293F004C000-memory.dmp

Download

memory/6092-1166-0x0000019094AF0000-0x0000019094AFC000-memory.dmp

Download

memory/6092-1167-0x0000019095020000-0x0000019095032000-memory.dmp

Download